CVE-2014-6277

CVE-2014-6277, also known as Shellshock, is a critical vulnerability in GNU Bash through version 4.3 that allows remote attackers to execute arbitrary code or cause a denial of service. This flaw stems from improper parsing of function definitions in environment variables, affecting scenarios like OpenSSH, Apache HTTP Server modules, and DHCP clients. With a CVSS score of 10.0, this vulnerability is easily exploitable over the network with low complexity and can lead to complete compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog, its high EPSS score, FAUCET Risk Score, and extensive community discussion (15 mentions) indicate significant exploitability and attention. Exploit code is publicly available on ExploitDB, and it has received substantial media coverage, highlighting its widespread impact and the need for immediate patching.